Error: Insufficient Privileges After Logging into a Salesforce Org — Caused by API Only User Permission

This article describes how to resolve the 'Insufficient Privileges' error caused by the 'API Only User' (PermissionsApiUserOnly) permission being enabled on a User's Profile. When this permission is enabled, users can only interact with Salesforce via API — they cannot log in through the UI. The steps below use Data Loader to update the Profile permission directly when no UI admin access is available.

Update 'API Only User' profile permission with Data Loader

1. Run an Export on the Profile object and include:

• ID
• API Only User (PermissionsApiUserOnly)
• Name (Optional)

2. Change the API Only User column from True to False for the Profile associated with the impacted Users, and save the file.
3. Use Data Loader to update the Profile permission. After logging in to Data Loader, click the Update button.
4. Select the Show all Salesforce objects checkbox and then select Profile.
5. Click Next after choosing the .csv file created in step 1.
6. Click Create or Edit a Map.
7. Map Profile ID and the Permission 'API Only User' to the fields you have in the .csv file.
8. Click OK.
9. Click Next and then Browse... to select the directory where the success and error files should be saved, then click Finish.
10. When the pop-up appears asking you to proceed, click Yes.

After this process has completed, ask the impacted end user to attempt to login again. If they are still unable to login, repeat the above steps using the PermissionSet object to remove API Only User from any Permission Sets assigned to the impacted user. 

If the user is still unable to login after API Only User has been set to False for the impacted users Profile and Permission Sets, please log a Case with Support for further assistance.